This is totally insane. I'm totally baffled by the idea that Microsoft considers it okay for anyone except the owner to have any level of access to personal email accounts.
If you are talking about secure e-mail cryptography philosophy along the lines of PGP, ProtonMail, et cetera, sure you can achieve that through those means. Otherwise it's a pipe dream with a product like Outlook that's built for businesses and having AD style control.
The problem is that an attacker can follow the "legitimate" path - and such attacks should be audited and detected, which is what obviously failed here.
Makes you wonder how vulnerable less mature services are...